Cybersecurity Threat Detection in the Behavior of IoT Devices

The plan:

1. Loading all data.
2. Extracting statistics regarding PIDs (cases) and syscall types (actions).
3. Computation of basic aggregations and visualization of the results.

The original source system audit logs are the property of KnowledgePit.ai platform and can be downloaded from: https://knowledgepit.ai/fedcsis-2023-challenge/

The available data contains 20044 log files. Each of the files corresponds to 10 minutes of syscall history. In total, 698 log files (3.48%) correspond to attacks on the devices.

To enable the analysis of this data using process mining techniques, I would suggest to consider the combination of a time window ID ( time_window_id ) and SYSCALL_pid values as cases and combinations of SYSCALL_syscall, SYSCALL_success, and maybe PROCESS_uid values as actions.

I transform the data by selecting SYSCALL_timestamp, SYSCALL_pid, SYSCALL_success, PROCESS_uid, and SYSCALL_syscall columns. I also merge all data tables into a single table for more convenient processing. Finally, I divide the data into three parts:

• process_discovery part,
  
• model_training part,
• test_data part.

load(file = "process_data_v2.RData")

process_discovery_data[SYSCALL_success == "", SYSCALL_success := "NA"]
model_training_data[SYSCALL_success == "", SYSCALL_success := "NA"]
test_data[SYSCALL_success == "", SYSCALL_success := "NA"]

setkey(process_discovery_data, time_window_id, SYSCALL_timestamp)
setkey(model_training_data, time_window_id, SYSCALL_timestamp)
setkey(test_data, time_window_id, SYSCALL_timestamp)

eventlog_data <- eventlog(as.data.frame(process_discovery_data),
                          case_id = c("time_window_id", "SYSCALL_pid"),
                          timestamp = "SYSCALL_timestamp",
                          activity_id = c("PROCESS_uid", "SYSCALL_syscall", "SYSCALL_success"),
                          activity_instance_id = c("time_window_id", "SYSCALL_pid", "PROCESS_uid", 
                                                   "SYSCALL_syscall", "SYSCALL_success", "SYSCALL_timestamp"),
                          resource_id = c("PROCESS_uid"),
                          lifecycle_id = "is_attack",
                          order = "alphabetical"
                          )

eventlog_data

# Log of 9500500 events consisting of:
159721 cases 
2212620 instances of 77 activities 
9 resources 
Events occurred from 2023-09-01 until 2023-09-01 16:39:59 
 
# Variables were mapped as follows:
Case identifier:        time_window_id_SYSCALL_pid 
Activity identifier:        PROCESS_uid_SYSCALL_syscall_SYSCALL_success 
Resource identifier:        PROCESS_uid 
Activity instance identifier:   time_window_id_SYSCALL_pid_PROCESS_uid_SYSCALL_syscall_SYSCALL_success_SYSCALL_timestamp 
Timestamp:          SYSCALL_timestamp 
Lifecycle transition:       is_attack 

trace_data <- traces(eventlog_data)
trace_data

frequent_traces <- filter_trace_frequency(eventlog_data, percentage = .8)
frequent_traces

# Log of 1697630 events consisting of:
127939 cases 
851163 instances of 24 activities 
3 resources 
Events occurred from 2023-09-01 until 2023-09-01 16:39:59 
 
# Variables were mapped as follows:
Case identifier:        time_window_id_SYSCALL_pid 
Activity identifier:        PROCESS_uid_SYSCALL_syscall_SYSCALL_success 
Resource identifier:        PROCESS_uid 
Activity instance identifier:   time_window_id_SYSCALL_pid_PROCESS_uid_SYSCALL_syscall_SYSCALL_success_SYSCALL_timestamp 
Timestamp:          SYSCALL_timestamp 
Lifecycle transition:       is_attack 

attack_traces <- filter_lifecycle_presence(eventlog_data, lifecycles = "TRUE", method = "all")
attack_traces

# Log of 462743 events consisting of:
5733 cases 
89658 instances of 44 activities 
5 resources 
Events occurred from 2023-09-01 until 2023-09-01 16:39:59 
 
# Variables were mapped as follows:
Case identifier:        time_window_id_SYSCALL_pid 
Activity identifier:        PROCESS_uid_SYSCALL_syscall_SYSCALL_success 
Resource identifier:        PROCESS_uid 
Activity instance identifier:   time_window_id_SYSCALL_pid_PROCESS_uid_SYSCALL_syscall_SYSCALL_success_SYSCALL_timestamp 
Timestamp:          SYSCALL_timestamp 
Lifecycle transition:       is_attack 

flow_plot <- process_map(frequent_traces, type = frequency("relative"))
flow_plot

frequent_attack_traces <- filter_trace_frequency(attack_traces, percentage = .8)
attacks_flow_plot <- process_map(frequent_attack_traces, type = frequency("relative"))
attacks_flow_plot

variant_viz <- trace_explorer(eventlog_data, coverage = 0.5)
variant_viz

eventlog_data_dt <- as.data.table(eventlog_data)

unique_action_ids <- eventlog_data_dt[, unique(PROCESS_uid_SYSCALL_syscall_SYSCALL_success)]
trace_dt <- eventlog_data_dt[, 
                             .(trace = paste(PROCESS_uid_SYSCALL_syscall_SYSCALL_success, 
                                             collapse = ","),
                               trace_length = .N),
                             by = time_window_id_SYSCALL_pid]

dim(trace_dt)

[1] 159721      3

trace_dt[, uniqueN(trace)]

[1] 3351

trace_dt <- compact_traces(trace_dt, unique_action_ids, 
                           show_progress = FALSE)

# trace_dt[, compacted_trace := copy(trace)]
# 
# trace_dt[, compacted_trace := gsub("root_close_yes,root_openat_yes",
#                                    "root_close_openat_yes", 
#                                    compacted_trace)]
# trace_dt[, compacted_trace := gsub("(,root_close_openat_yes){2,}", 
#                                    ",multi_root_close_openat_yes",
#                                    compacted_trace)]
# trace_dt[, compacted_trace := gsub("^root_close_openat_yes,multi_root_close_openat_yes",
#                                    "multi_root_close_openat_yes",
#                                    compacted_trace)]
# trace_dt[, compacted_trace := gsub("^root_close_openat_yes,root_close_openat_yes",
#                                    "multi_root_close_openat_yes",
#                                    compacted_trace)]
# trace_dt[, uniqueN(compacted_trace)]
# 
# for(action in unique_action_ids) {
#   trace_dt[, compacted_trace := gsub(paste0("(,", action, "){2,}"), 
#                                      paste0(",multi_", action), 
#                                      compacted_trace)]
#   trace_dt[, compacted_trace := gsub(paste0("^", action, ",multi_", action), 
#                                      paste0("multi_", action), 
#                                      compacted_trace)]
#   trace_dt[, compacted_trace := gsub(paste0("^", action, ",", action), 
#                                      paste0("multi_", action), 
#                                      compacted_trace)]
#   print(action)
# }
# trace_dt[, uniqueN(compacted_trace)]
# trace_dt[, compacted_trace_length := sapply(strsplit(compacted_trace, ","), length)]

normalized_levenshtein_dist <- function(x, y) {
  ldist <- proxy::dist(list(x), list(y), method = "Levenshtein")
  as.numeric(ldist)/(length(x) + length(y))
}

dist_matrix <- proxy::dist(strsplit(trace_dt[, unique(compacted_trace)], ","), 
                           method = normalized_levenshtein_dist)

hclustering <- hclust(dist_matrix, method = "ward.D")

mds_embedds <- cmdscale(dist_matrix, k = 2)
plot(mds_embedds, col = cutree(hclustering, k = 5), 
     xlab = "latent dim 1", 
     ylab = "latent dim 2",
     main = "Multidimensional scaling of trace variants")

save(dist_matrix, mds_embedds, file = "variant_distance_matrix.RData")

fig1 <- ggplot(data.table(mds_embedds), 
               aes(x=V1, y=V2, colour = factor(cutree(hclustering, k = 5)))) +
  geom_point() + 
  labs(x = "latent dim 1", y = "latent dim 2", colour = "group", 
       title = "Multidimensional scaling of trace variants")
fig1

process_discovery_data[, time_window_id_SYSCALL_pid := paste0(time_window_id, "_", SYSCALL_pid)]
trace_dt <- trace_dt[process_discovery_data[, .(attack = is_attack[1]), 
                                            by = time_window_id_SYSCALL_pid], 
                     on = "time_window_id_SYSCALL_pid"]

global_mean <- trace_dt[, mean(attack)]
variant_dt <- trace_dt[, .(attack_prob = (sum(attack) + global_mean)/(.N + 1),
                           n_of_traces = .N), 
                       by = compacted_trace]

# here I'm relying on the assumption about the same ordering of variants - might be risky
variant_dt[, cluster_id := cutree(hclustering, k = 5)]


fig2 <- ggplot(data.table(mds_embedds), aes(x=V1, y=V2, 
                                            colour = variant_dt[, attack_prob], 
                                            #shape = factor(variant_dt[, cluster_id]),
                                            size = variant_dt[, log(n_of_traces)]
                                            )) +
  geom_point() + 
  scale_color_gradient2(midpoint=0.5, low="blue", mid="white",
                        high="red", space ="Lab" ) +
  labs(x = "latent dim 1", y = "latent dim 2", colour = "attack prob", size = "log(#traces)",
       title = "Multidimensional scaling of trace variants")
fig2

dist_array <- as.matrix(dist_matrix)

variant_dt[, distance_to_cluster_members := 
              {sapply(.I, function(index) {
                            id = variant_dt[index, cluster_id]; 
                            sum(dist_array[index, variant_dt[, which(cluster_id == id)]] * 
                                variant_dt[cluster_id == id, n_of_traces])
                          })
              }]

# selecting cluster representatives
n_of_reps <- 5
cluster_reps <- variant_dt[, {id = first(order(distance_to_cluster_members), n_of_reps); 
                              .(index = .I[id],
                                n_of_traces = n_of_traces[id], 
                                attack_prob = attack_prob[id],
                                distance_to_cluster_members = distance_to_cluster_members[id]
                              )},
                           by = cluster_id]

fig3 <- ggplot(data.table(mds_embedds), aes(x=V1, y=V2, 
                                            colour = variant_dt[, attack_prob], 
                                            #shape = factor(variant_dt[, cluster_id]),
                                            size = variant_dt[, log(n_of_traces)]
                                            )) +
  geom_point() + 
  scale_color_gradient2(midpoint=0.5, low="blue", mid="white",
                        high="red", space ="Lab" ) +
  geom_point(data = data.table(mds_embedds[cluster_reps[, index], ]),
             color = variant_dt[cluster_reps[, index], factor(cluster_id)], 
             size = 2) + 
  labs(x = "latent dim 1", y = "latent dim 2", colour = "attack prob", size = "log(#traces)",
       title = "Visualization of variants with marked cluster representatives")
fig3

# selecting the largest variants
n_of_largest <- 5
largest_variants <- variant_dt[, {id = last(order(n_of_traces), n_of_largest); 
                                .(index = .I[id],
                                  n_of_traces = n_of_traces[id], 
                                  attack_prob = attack_prob[id],
                                  distance_to_cluster_members = distance_to_cluster_members[id]
                                )},
                              by = cluster_id]

fig4 <- ggplot(data.table(mds_embedds), aes(x=V1, y=V2, 
                                            colour = variant_dt[, attack_prob], 
                                            size = variant_dt[, log(n_of_traces)]
                                            )) +
  geom_point() + 
  scale_color_gradient2(midpoint=0.5, low="blue", mid="white",
                        high="red", space ="Lab" ) +
  geom_point(data = data.table(mds_embedds[largest_variants[, index], ]),
             color = variant_dt[largest_variants[, index], factor(cluster_id)], 
             size = 2) + 
  labs(x = "latent dim 1", y = "latent dim 2", colour = "attack prob", size = "log(#traces)",
       title = "Visualization of variants with marked largest variants for each cluster")
fig4

# selecting the largest variants
n_of_extreme_attack_probs <- 5
min_trace_count <- 10
extreme_variants <- variant_dt[n_of_traces > min_trace_count, 
                               {id = order(attack_prob); 
                                id = c(first(id, n_of_extreme_attack_probs), 
                                       last(id, n_of_extreme_attack_probs)); 
                              .(index = .I[id],
                                n_of_traces = n_of_traces[id], 
                                attack_prob = attack_prob[id],
                                distance_to_cluster_members = distance_to_cluster_members[id]
                              )},
                           by = .(cluster_id)]

fig5 <- ggplot(data.table(mds_embedds), aes(x=V1, y=V2, 
                                            colour = variant_dt[, attack_prob], 
                                            size = variant_dt[, log(n_of_traces)]
                                            )) +
  geom_point() + 
  scale_color_gradient2(midpoint=0.5, low="blue", mid="white",
                        high="red", space ="Lab" ) +
  geom_point(data = data.table(mds_embedds[extreme_variants[, index], ]),
             colour = variant_dt[extreme_variants[, index], factor(cluster_id)], 
             size = 2) + 
  labs(x = "latent dim 1", y = "latent dim 2", colour = "attack prob", size = "log(#traces)",
       title = "Visualization of variants with extreme attack probabilities")
fig5

unique(rbind(cluster_reps, largest_variants, extreme_variants))

save(variant_dt, cluster_reps, largest_variants, extreme_variants,
     file = "selected_variants.RData")